Security researchers have disclosed a critical vulnerability in CIFSwitch Linux that permits unauthenticated attackers to obtain root-level access on affected systems. This flaw impacts multiple Linux distributions running vulnerable versions of CIFSwitch. The vulnerability bypasses standard authentication mechanisms, allowing direct privilege escalation.

Redline infostealer malware has become a critical tool in the hands of ransomware affiliates, initial access brokers, and extortion groups targeting professional service firms. By stealing session cookies and authentication tokens, attackers can bypass multi-factor authentication and gain persistent access to corporate networks without requiring valid credentials.

Security researchers have identified ChatGPhish, a vulnerability that exploits ChatGPT's web summary functionality to deliver phishing attacks at scale. By manipulating how the AI processes and summarizes web content, attackers can inject malicious prompts and credential harvesting payloads into seemingly legitimate summaries.

ShinyHunters, a known threat actor group, has been observed deploying backdoor access into education sector networks to establish persistent access and exfiltrate sensitive student information. This campaign targets institutional databases containing enrollment records, personally identifiable information, and authentication credentials.

Rapid7 researchers have documented active exploitation of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal. Unknown threat actors are leveraging this vulnerability to bypass authentication controls on remote access infrastructure, potentially gaining unauthorized entry to enterprise networks.

Security researchers have identified BTMOB, an Android malware service attributed to ScarCruft and associated threat actors Johnk3r and Merl, that generates custom phishing payloads targeting banking, cryptocurrency, government, and streaming service users. The malware leverages related tools including BirdCall, NoVoice, and SpySolr to deliver tailored phishing campaigns.